Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack

Authors: Francesco Croce, Matthias Hein
Published: 2019-07-03 | Updated: 2020-07-20

Source: https://arxiv.org/abs/1907.02044

PDF: https://arxiv.org/pdf/1907.02044

AIにより推定されたラベル

敵対的攻撃 ポイズニング 敵対的サンプルの脆弱性

※ こちらのラベルはAIによって自動的に追加されました。そのため、正確でないことがあります。
詳細は文献データベースについてをご覧ください。

Abstract

The evaluation of robustness against adversarial manipulation of neural networks-based classifiers is mainly tested with empirical attacks as methods for the exact computation, even when available, do not scale to large networks. We propose in this paper a new white-box adversarial attack wrt the l_p-norms for p ∈ {1, 2, ∞} aiming at finding the minimal perturbation necessary to change the class of a given input. It has an intuitive geometric meaning, yields quickly high quality results, minimizes the size of the perturbation (so that it returns the robust accuracy at every threshold with a single run). It performs better or similar to state-of-the-art attacks which are partially specialized to one l_p-norm, and is robust to the phenomenon of gradient masking.